
void detectDcomNtlmReflection() {

    std::cout << "\n[*] Checking DCOM/NTLM Reflection (Rotten/Juicy Potato) vulnerability...\n";

    DWORD releaseIdBSize = 8192;
    wchar_t releaseId[255];
    wchar_t* releaseIdEnd;
    RegGetValue(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", L"ReleaseId", RRF_RT_ANY, NULL, (PVOID)&releaseId, &releaseIdBSize);
    
    std::vector <LPCSTR> goldenPrivs;

    DWORD dwError;
    HANDLE hToken;
    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken)) {
        dwError = GetLastError();
        std::cout << "OpenProcessToken failed, error " << dwError;
    }

    DWORD len = 0;
    if (!GetTokenInformation(hToken, TokenPrivileges, NULL, 0, &len)) {
        dwError = GetLastError();
        if (dwError != ERROR_INSUFFICIENT_BUFFER) {
            std::cout << "GetTokenInformation failed, error " << dwError;
            CloseHandle(hToken);
        }
    }

    PTOKEN_PRIVILEGES tokenPrivs = (PTOKEN_PRIVILEGES)LocalAlloc(LPTR, len);

    if (!tokenPrivs) {
        dwError = GetLastError();
        std::cout << "LocalAlloc failed, error " << dwError;
        CloseHandle(hToken);
    }

    if (!GetTokenInformation(hToken, TokenPrivileges, tokenPrivs, len, &len)) {
        dwError = GetLastError();
        std::cout << "GetTokenInformation failed, error " << dwError;
        LocalFree(tokenPrivs);
        CloseHandle(hToken);
    }

    for (DWORD i = 0; i < tokenPrivs->PrivilegeCount; i++) {

        DWORD dwSize = 0;
        LookupPrivilegeNameA(NULL, &tokenPrivs->Privileges[i].Luid, NULL, &dwSize);
        LPSTR szName = new CHAR[dwSize + 1];
        LookupPrivilegeNameA(NULL, &tokenPrivs->Privileges[i].Luid, szName, &dwSize);

        auto& tAttr = tokenPrivs->Privileges[i].Attributes;
        auto& tLuid = tokenPrivs->Privileges[i].Attributes;


        if (strcmp(szName, "SeAssignPrimaryTokenPrivilege") == 0) {
            if (tAttr & SE_PRIVILEGE_ENABLED) {
                goldenPrivs.push_back("SeAssignPrimaryTokenPrivilege (Enabled)");
            }
            else {
                goldenPrivs.push_back("SeAssignPrimaryTokenPrivilege (Disabled)");
            }
        }
        
        if (strcmp(szName, "SeImpersonatePrivilege") == 0) {
            if (tAttr & SE_PRIVILEGE_ENABLED) {
                goldenPrivs.push_back("SeImpersonatePrivilege (Enabled)");
            }
            else {
                goldenPrivs.push_back("SeImpersonatePrivilege (Disabled)");
            }
        }

    }
    
    if (goldenPrivs.size() > 0) {
        if (wcstol(releaseId, &releaseIdEnd, 10) <= 1809) {
            std::cout << "\n\tYou have following privileges and OS build number is equal/lower than 1809.\n\n";

            for (LPCSTR goldenPriv : goldenPrivs) {
                std::cout << "\t\t- " << goldenPriv << "\n";
            }

            std::cout << "\n\tThis indicates that the system is vulnerable for DCOM/NTLM Reflection attack, you can use Rotten/Juicy Potato exploit.\n";
        }
    }

    CloseHandle(hToken);
}
